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1 . An examiner's amendment to the record appears below. Should the changes 
and/or additions be unacceptable to applicant, an amendment may be filed as provided 
by 37 CFR 1.312. To ensure consideration of such an amendment, it MUST be 
submitted no later than the payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview 
with Mr. Vincent Anderson on */1 4/2006. 

2. The application has been amended as follows: The following claims has been 
amended. 

47. (Currently Amended) A system for filtering packets comprising: 
a packet buffer for storing packets; 

a protocol element locator for indicating a protocol element in a packet; 

a filtering database comprising layered tables of rules, each rule table applying to 
a respective protocol element of a packet and comprising the protocol element locator, 
and at l oast on e ru l e a default rule and zero or more additional filtering rules to be 
applied to the protocol element in the packet; and 

a rule evaluator having a first input coupled to the packet buffer for using the 
protocol element locator to determine a protocol element from the packet and for 
applying at least one rule table to the protocol element. 

55. (Currently Amended) A method for filtering packets in a system comprising a 
filtering database containing layered tables of rule tables, the method comprising the 
steps of: 

selecting a protocol element from a packet; 

accessing a unique rule table in said layered tables of rule tables corresponding 
to the selected protocol element; said rule table comprising at l oast ono fi l ter i ng ru l e a 
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default rule, zero or more additional filtering rules, and a protocol element 
locator : and 

applying the at l east on e f il t e ring ru l e default rule and zero or more 
additional filtering rules and the protocol element locator of the unique rule 
table to the selected protocol element. 

57. (Currently Amended) The method of claim 55 wherein the step of applying the 
at l east one f il ter i ng ru l e default rule and zero or more additional filtering rules 

comprises the substep of: 

determining whether the selected protocol element is less than or equal to an 
upper bound. 

58. (Currently Amended) The method of claim 55 wherein the step of applying the 
at least one f il tering rule default rule and zero or more additional filtering rules 

comprises the substep of: 

determining whether the selected protocol element is groat greater than or equal 
to a lower bound. 

63. (Currently Amended) A system for modifying a filtering database comprising: 

a packet prototype for determining a location to be modified in the filtering 
database, the packet prototype comprising at least one protocol element 
descriptor having a default rule flag pointing to a default rule, an upper bound 
and a lower bound, wherein said lower bound and said upper bound are used to 
point to a location in the filtering database, and 

a filtering engine for receiving the packet prototype from an external software 
source and for modifying the location determined by the packet prototype. 

The claim 64 Has been canceled 



72. 



(Currently Amended) An apparatus for filtering packets comprising: 
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a plurality of protocol element locators, each protocol element locator selects 
having an offset and a mask for selecting one of a plurality of protocol elements from 
a packet; 

a plurality of rule tables, each rule table corresponding to a respective protocol 
element; and 

a rules database implemented in a storage medium having a default rule and 
a filtering action for each rule table. 

3. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to AJIT G. PATEL whose telephone number is 571-272- 
3140. The examiner can normally be reached on MONDAY-SATURDAY. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Wellington Chin can be reached on 571-272-3134. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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